CVE-2022-0492: Linux kernel cgroups v1 release_agent privilege escalation and container escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a near-term due date and enables container escape and host privilege escalation, though it requires local low-privileged access.

What it is

The Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be abused to escalate privileges and bypass namespace isolation. Because it breaks container boundaries, it matters to any host running containers or relying on namespaces as a security control.

Impact

An attacker with local access gains elevated privileges on the host and can escape container or namespace isolation, potentially taking over the node and other workloads on it.

Attack surface

Reached locally (CVSS AV:L) by a user who already has low privileges (PR:L); no user interaction is required (UI:N). It applies where cgroups v1 and the release_agent mechanism are in use, typically container environments.

Exploitation

CISA added it to KEV with a 2026-06-05 due date, and references include an exploit-tagged writeup on Docker cgroups container escape; EPSS 30-day probability is about 5.5 percent (92nd percentile). No ransomware campaign use is documented.

What to do

• Apply the upstream kernel patch (commit 24f6008564183aa120d07c03d9289519c2fe02af) or your distribution's fixed kernel package.
• Follow vendor advisories for Red Hat, Debian, Canonical, Fedora and NetApp products listed in the record.
• Where patching is not possible, restrict container workloads from using cgroups v1 release_agent or move to cgroups v2.
• Reduce who can run containers or obtain local shell access on affected hosts.
• If mitigations are unavailable, discontinue use of the affected product per CISA guidance.

Detection

• Monitor for writes to cgroup release_agent files and unexpected execution of release_agent scripts on container hosts.
• Alert on processes spawning from container namespaces with host-level privileges or unexpected parentage.
• Audit container runtime and kernel versions against the fixed releases for the listed vendors.
• Watch for privilege escalation attempts from low-privileged local users on hosts running cgroups v1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.